botversion-sdk 2.2.3 → 2.3.1

package/scanner-sdk/scan/hapi.js

@@ -0,0 +1,997 @@
+// ─────────────────────────────────────────────────────────────
+// FILE: scan/hapi.js
+// PURPOSE: Finds API routes in Hapi projects by reading code structure (not by guessing from text patterns).
+// CONTAINS: scanHapiRoutes
+// USED BY: scanner.js (scanHapiRoutes)
+// DEPENDS ON: ./field-extractors, ./text-utils
+// HOW IT WORKS:
+//   1. Reads every code file once and builds a "masked" copy (comments and string contents blanked) so route-like
+//      text in comments/strings is never mistaken for a real route.
+//   2. Finds every .route(...) call (any variable name), plus route arrays exported from files (module.exports / export default).
+//   3. Reads each route object's top-level keys (method, path, handler), so nested options can never confuse it.
+//   4. Follows plugin registrations (register(plugin, { routes: { prefix } })) through nested plugins to build full paths.
+//   5. Reads request fields, query fields, uploads and reply shapes from the route's own code (or its named/imported handler).
+// ─────────────────────────────────────────────────────────────
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const {
+  buildRouteParamMap,
+  collectStringConstants,
+  blankOutComments,
+  joinMountPath,
+  sliceCallText,
+  skipStaticString,
+  findStaticClosingBrace,
+  splitStaticEntries,
+} = require("./text-utils");
+const {
+  extractQueryFieldsFromFile,
+  findNamedHandlerCode,
+  inferFieldType,
+} = require("./field-extractors");
+
+const DEBUG = process.env.BOTVERSION_DEBUG === "1";
+
+const SKIP_DIRS = new Set([
+  "node_modules",
+  ".git",
+  ".next",
+  "dist",
+  "build",
+  ".cache",
+  "coverage",
+  "out",
+  "test",
+  "tests",
+  "__tests__",
+  "__mocks__",
+  "spec",
+  "e2e",
+]);
+const CODE_FILE = /\.(?:js|cjs|mjs|ts|mts|cts)$/;
+const TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]s$/;
+const ALLOWED_METHODS = new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+  "*",
+]);
+const KEY_RE = /^(?:"([^"]+)"|'([^']+)'|([A-Za-z_$][\w$]*))\s*:\s*([\s\S]*)$/;
+
+function escapeRe(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// ── Text helpers ─────────────────────────────────────────────
+
+// Same-length copy of the text with comments and string CONTENTS blanked (quotes kept), so structure can be searched safely
+function maskCommentsAndStrings(text) {
+  const out = text.split("");
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    const next = text[i + 1];
+    if (ch === "/" && next === "/") {
+      while (i < text.length && text[i] !== "\n") {
+        out[i] = " ";
+        i++;
+      }
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      const end = text.indexOf("*/", i + 2);
+      const stop = end === -1 ? text.length : end + 2;
+      for (; i < stop; i++) {
+        if (text[i] !== "\n") out[i] = " ";
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const close = skipStaticString(text, i, text.length);
+      if (close === -1) {
+        i++;
+        continue;
+      }
+      for (let k = i + 1; k < close; k++) {
+        if (text[k] !== "\n") out[k] = " ";
+      }
+      i = close + 1;
+      continue;
+    }
+    i++;
+  }
+  return out.join("");
+}
+
+// Index of the bracket that closes the one at openIdx, for ( [ { (-1 if it cannot be matched safely)
+function findClosing(text, openIdx) {
+  const limit = Math.min(text.length, openIdx + 200000);
+  let depth = 0;
+  for (let i = openIdx; i < limit; i++) {
+    const ch = text[i];
+    const next = text[i + 1];
+    if (ch === "/" && next === "/") {
+      const nl = text.indexOf("\n", i);
+      if (nl === -1) return -1;
+      i = nl;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      const end = text.indexOf("*/", i + 2);
+      if (end === -1) return -1;
+      i = end + 1;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const c = skipStaticString(text, i, limit);
+      if (c === -1) return -1;
+      i = c;
+      continue;
+    }
+    if (ch === "{" || ch === "[" || ch === "(") depth++;
+    else if (ch === "}" || ch === "]" || ch === ")") {
+      depth--;
+      if (depth === 0) return i;
+      if (depth < 0) return -1;
+    }
+  }
+  return -1;
+}
+
+// ── Reading files, imports and plugin registrations ─────────
+
+function collectFiles(cwd) {
+  const files = [];
+  function walk(dir, depth) {
+    if (depth > 12) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir);
+    } catch (e) {
+      return;
+    }
+    for (const entry of entries) {
+      if (SKIP_DIRS.has(entry)) continue;
+      const full = path.join(dir, entry);
+      let stat;
+      try {
+        stat = fs.statSync(full);
+      } catch (e) {
+        continue;
+      }
+      if (stat.isDirectory()) {
+        walk(full, depth + 1);
+        continue;
+      }
+      if (
+        !CODE_FILE.test(entry) ||
+        /\.d\.[cm]?ts$/.test(entry) ||
+        TEST_FILE.test(entry)
+      )
+        continue;
+      if (stat.size > 1000000) continue;
+      let content;
+      try {
+        content = fs.readFileSync(full, "utf8");
+      } catch (e) {
+        continue;
+      }
+      files.push({
+        abs: full,
+        rel: path.relative(cwd, full),
+        content: content,
+        masked: maskCommentsAndStrings(content),
+        imports: {},
+        regs: [],
+      });
+    }
+  }
+  walk(cwd, 0);
+  return files;
+}
+
+function resolveRelative(fromAbs, spec, filesByAbs) {
+  const base = path.resolve(path.dirname(fromAbs), spec);
+  const exts = ["", ".js", ".cjs", ".mjs", ".ts", ".mts", ".cts"];
+  for (const e of exts) {
+    if (filesByAbs[base + e]) return base + e;
+  }
+  for (const e of exts.slice(1)) {
+    const p = path.join(base, "index" + e);
+    if (filesByAbs[p]) return p;
+  }
+  return null;
+}
+
+// ident -> { file, member } for relative require()/import statements
+function readImports(file, filesByAbs) {
+  const map = {};
+  const t = file.content;
+  const live = function (i) {
+    return file.masked[i] === t[i];
+  };
+  const add = function (ident, spec, member) {
+    const abs = resolveRelative(file.abs, spec, filesByAbs);
+    if (abs && ident) map[ident] = { file: abs, member: member };
+  };
+  let m;
+  const r1 =
+    /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\s*\(\s*(['"`])(\.[^'"`]*)\2\s*\)/g;
+  while ((m = r1.exec(t)) !== null) if (live(m.index)) add(m[1], m[3], null);
+  const r2 =
+    /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\s*\(\s*(['"`])(\.[^'"`]*)\2\s*\)/g;
+  while ((m = r2.exec(t)) !== null) {
+    if (!live(m.index)) continue;
+    m[1].split(",").forEach(function (p) {
+      const parts = p.split(":").map(function (s) {
+        return s.trim();
+      });
+      if (!parts[0]) return;
+      add((parts[1] || parts[0]).split("=")[0].trim(), m[3], parts[0]);
+    });
+  }
+  const r3 = /import\s+([A-Za-z_$][\w$]*)\s+from\s+(['"`])(\.[^'"`]*)\2/g;
+  while ((m = r3.exec(t)) !== null)
+    if (live(m.index)) add(m[1], m[3], "default");
+  const r4 = /import\s+(?:type\s+)?\{([^}]+)\}\s*from\s*(['"`])(\.[^'"`]*)\2/g;
+  while ((m = r4.exec(t)) !== null) {
+    if (!live(m.index)) continue;
+    m[1].split(",").forEach(function (p) {
+      const parts = p.trim().split(/\s+as\s+/);
+      if (!parts[0]) return;
+      add((parts[1] || parts[0]).trim(), m[3], parts[0].trim());
+    });
+  }
+  const r5 =
+    /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+(['"`])(\.[^'"`]*)\2/g;
+  while ((m = r5.exec(t)) !== null) if (live(m.index)) add(m[1], m[3], null);
+  return map;
+}
+
+// register(plugin, { routes: { prefix } }) calls, resolved to the file that holds the plugin
+function readRegistrations(file, filesByAbs) {
+  const regs = [];
+  const re = /\.\s*register\s*\(/g;
+  let m;
+  while ((m = re.exec(file.masked)) !== null) {
+    const callText = sliceCallText(file.content, m.index);
+    if (!callText) continue;
+    const prefixMatch = /prefix\s*:\s*(['"`])([^'"`]*)\1/.exec(callText);
+    let target = null;
+    const viaRequire =
+      /^\.\s*register\s*\(\s*require\s*\(\s*(['"`])(\.[^'"`]*)\1\s*\)/.exec(
+        callText,
+      );
+    const viaName = /^\.\s*register\s*\(\s*([A-Za-z_$][\w$]*)/.exec(callText);
+    if (viaRequire)
+      target = resolveRelative(file.abs, viaRequire[2], filesByAbs);
+    else if (viaName && file.imports[viaName[1]])
+      target = file.imports[viaName[1]].file;
+    if (target && target !== file.abs)
+      regs.push({
+        from: file.abs,
+        target: target,
+        prefix: prefixMatch ? prefixMatch[2] : "",
+      });
+  }
+  return regs;
+}
+
+function joinPath(prefix, p) {
+  let rp = String(p || "");
+  if (rp && rp[0] !== "/") rp = "/" + rp;
+  if (!prefix) return rp || "/";
+  return joinMountPath(prefix, rp || "/");
+}
+
+// Every full prefix a plugin file ends up with (a plugin registered inside another plugin gets both prefixes)
+function prefixesOf(abs, stack, regsByTarget) {
+  const incoming = regsByTarget[abs];
+  if (!incoming || stack.indexOf(abs) !== -1) return [""];
+  const out = [];
+  incoming.forEach(function (r) {
+    prefixesOf(r.from, stack.concat(abs), regsByTarget).forEach(function (p) {
+      const v = r.prefix ? joinPath(p, r.prefix) : p;
+      if (out.indexOf(v) === -1) out.push(v);
+    });
+  });
+  return out.length ? out : [""];
+}
+
+// ── Reading route objects ────────────────────────────────────
+
+// Index of "{" or "[" for "const NAME = {" / "= ["  (-1 if not found)
+function findDecl(file, name) {
+  const re = new RegExp(
+    "(?:const|let|var)\\s+" +
+      escapeRe(name) +
+      "\\s*(?::[^=\\n]+)?=\\s*([\\[{])",
+  );
+  const m = re.exec(file.masked);
+  return m ? m.index + m[0].length - 1 : -1;
+}
+
+// top-level keys of an object literal text -> value text (spreads of same-file objects are merged in)
+function propsOfObjectText(objText, file, depth) {
+  const t = objText.trim();
+  if (t[0] !== "{" || t[t.length - 1] !== "}") return null;
+  const entries = splitStaticEntries(t.slice(1, -1));
+  if (!entries) return null;
+  const props = Object.create(null);
+  entries.forEach(function (entry) {
+    if (entry.startsWith("...")) {
+      const name = entry.slice(3).trim();
+      if (depth < 3 && /^[A-Za-z_$][\w$]*$/.test(name)) {
+        const open = findDecl(file, name);
+        if (open !== -1 && file.masked[open] === "{") {
+          const close = findClosing(file.content, open);
+          if (close !== -1) {
+            const inner = propsOfObjectText(
+              file.content.slice(open, close + 1),
+              file,
+              depth + 1,
+            );
+            if (inner)
+              Object.keys(inner).forEach(function (k) {
+                props[k] = inner[k];
+              });
+          }
+        }
+      }
+      return;
+    }
+    const m = KEY_RE.exec(entry);
+    if (m) {
+      props[m[1] || m[2] || m[3]] = m[4].trim();
+      return;
+    }
+    if (/^[A-Za-z_$][\w$]*$/.test(entry)) props[entry] = entry;
+  });
+  return props;
+}
+
+// Finds every route object in a file: server.route({..}) / server.route([..]) / server.route(NAME) / exported route arrays
+function collectRouteObjects(file) {
+  const out = [];
+  const t = file.content;
+  const pushObject = function (open, requireHandler) {
+    const close = findClosing(t, open);
+    if (close !== -1)
+      out.push({
+        objText: t.slice(open, close + 1),
+        requireHandler: requireHandler,
+      });
+  };
+  const pushArray = function (open, requireHandler) {
+    const close = findClosing(t, open);
+    if (close === -1) return;
+    const entries = splitStaticEntries(t.slice(open + 1, close));
+    if (!entries) return;
+    entries.forEach(function (entry) {
+      if (entry[0] === "{")
+        out.push({ objText: entry, requireHandler: requireHandler });
+      else if (/^[A-Za-z_$][\w$]*$/.test(entry)) {
+        const o = findDecl(file, entry);
+        if (o !== -1 && file.masked[o] === "{") pushObject(o, requireHandler);
+      }
+    });
+  };
+  const pushAt = function (idx, requireHandler) {
+    const ch = file.masked[idx];
+    if (ch === "{") pushObject(idx, requireHandler);
+    else if (ch === "[") pushArray(idx, requireHandler);
+  };
+
+  const callRe = /\.\s*route\s*\(\s*/g;
+  let m;
+  while ((m = callRe.exec(file.masked)) !== null) {
+    const argIdx = m.index + m[0].length;
+    const ch = file.masked[argIdx];
+    if (ch === "{" || ch === "[") {
+      pushAt(argIdx, false);
+      continue;
+    }
+    if (/[A-Za-z_$]/.test(ch)) {
+      const idm = /^[A-Za-z_$][\w$]*/.exec(
+        file.masked.slice(argIdx, argIdx + 100),
+      );
+      if (
+        !idm ||
+        !/^\s*\)/.test(
+          file.masked.slice(
+            argIdx + idm[0].length,
+            argIdx + idm[0].length + 20,
+          ),
+        )
+      )
+        continue;
+      const open = findDecl(file, idm[0]);
+      if (open !== -1) pushAt(open, false);
+    }
+  }
+  // Route files loaded by a loader: module.exports = [ {...} ] / export default [ {...} ]
+  const expRe = /(?:module\.exports\s*=|export\s+default)\s*(?=[\[{])/g;
+  while ((m = expRe.exec(file.masked)) !== null)
+    pushAt(m.index + m[0].length, true);
+  return out;
+}
+
+// ── Evaluating method / path values ──────────────────────────
+
+function collectConsts(file) {
+  const consts = Object.assign(
+    {},
+    collectStringConstants(blankOutComments(file.content)),
+  );
+  const re =
+    /(?:^|\n)\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*(?:Object\.freeze\s*\(\s*)?\{/g;
+  let m;
+  while ((m = re.exec(file.masked)) !== null) {
+    const open = m.index + m[0].length - 1;
+    const close = findClosing(file.content, open);
+    if (close === -1) continue;
+    const entries = splitStaticEntries(file.content.slice(open + 1, close));
+    if (!entries) continue;
+    entries.forEach(function (entry) {
+      const kv = KEY_RE.exec(entry);
+      if (!kv) return;
+      const lit = /^(['"`])([^'"`$\n]*)\1$/.exec(kv[4].trim());
+      if (lit) consts[m[1] + "." + (kv[1] || kv[2] || kv[3])] = lit[2];
+    });
+  }
+  return consts;
+}
+
+function hasOwn(o, k) {
+  return Object.prototype.hasOwnProperty.call(o, k);
+}
+
+function evalMethods(v, consts) {
+  v = String(v).trim();
+  const found = [];
+  if (v[0] === "[") {
+    const re = /(['"`])([A-Za-z*]+)\1/g;
+    let m;
+    while ((m = re.exec(v)) !== null) found.push(m[2]);
+  } else {
+    const one = /^(['"`])([A-Za-z*]+)\1$/.exec(v);
+    if (one) found.push(one[2]);
+    else if (hasOwn(consts, v)) found.push(consts[v]);
+  }
+  const known = found
+    .map(function (x) {
+      return x.toUpperCase();
+    })
+    .filter(function (x) {
+      return x !== "HEAD" && x !== "OPTIONS"; // HEAD/OPTIONS handlers are not separate endpoints
+    });
+  const ok = known.filter(function (x) {
+    return ALLOWED_METHODS.has(x);
+  });
+  if (ok.length === 0 || ok.length !== known.length) return null;
+  return ok.filter(function (x, i) {
+    return ok.indexOf(x) === i;
+  });
+}
+
+function evalPath(v, consts) {
+  v = String(v).trim();
+  let m = /^(['"])([^'"\n]*)\1$/.exec(v);
+  if (m) return m[2];
+  m = /^`([^`]*)`$/.exec(v);
+  if (m) {
+    let bad = false;
+    const out = m[1].replace(
+      /\$\{\s*([A-Za-z_$][\w$.]*)\s*\}/g,
+      function (all, name) {
+        if (hasOwn(consts, name)) return consts[name];
+        bad = true;
+        return all;
+      },
+    );
+    return bad || out.indexOf("${") !== -1 ? null : out;
+  }
+  if (hasOwn(consts, v)) return consts[v];
+  return null;
+}
+
+// ── Handler lookup (same file, or imported from another file) ─
+
+function sliceHandlerBody(text, declIdx, afterEq) {
+  let start = afterEq;
+  const arrow = text.indexOf("=>", start);
+  const semi = text.indexOf(";", start);
+  if (arrow !== -1 && (semi === -1 || arrow < semi)) start = arrow + 2;
+  const brace = text.indexOf("{", start);
+  const semi2 = text.indexOf(";", start);
+  if (semi2 !== -1 && (brace === -1 || semi2 < brace))
+    return text.slice(declIdx, semi2 + 1);
+  if (brace === -1) return null;
+  const close = findStaticClosingBrace(text, brace);
+  return close === null ? null : text.slice(declIdx, close + 1);
+}
+
+// "exports.name = async (request, h) => {...}" style handlers
+function findAssignedHandlerCode(text, name) {
+  const re = new RegExp(
+    "(?:module\\.)?exports\\." + escapeRe(name) + "\\s*=\\s*",
+  );
+  const m = re.exec(text);
+  return m ? sliceHandlerBody(text, m.index, m.index + m[0].length) : null;
+}
+
+function handlerFromFile(imp, member, filesByAbs) {
+  const target = filesByAbs[imp.file];
+  if (!target || !member || member === "default") return "";
+  return (
+    findNamedHandlerCode(target.content, member) ||
+    findAssignedHandlerCode(target.content, member) ||
+    ""
+  );
+}
+
+// Extra handler code when the route points at a named/imported handler; inline handlers are already part of the route text
+function resolveHandlerCode(file, handlerExpr, filesByAbs) {
+  if (!handlerExpr) return "";
+  const v = handlerExpr.trim();
+  if (/^(?:async\b|function\b|\(|[A-Za-z_$][\w$]*\s*=>|\{)/.test(v)) return "";
+  let m = /^([A-Za-z_$][\w$]*)$/.exec(v);
+  if (m) {
+    const same = findNamedHandlerCode(file.content, m[1]);
+    if (same) return same;
+    const imp = file.imports[m[1]];
+    return imp ? handlerFromFile(imp, imp.member || m[1], filesByAbs) : "";
+  }
+  m = /^([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)$/.exec(v);
+  if (m && file.imports[m[1]])
+    return handlerFromFile(file.imports[m[1]], m[2], filesByAbs);
+  return "";
+}
+
+// ── Reading request fields ───────────────────────────────────
+
+function joiTypeSchema(valueExpr) {
+  const m = /^[A-Za-z_$][\w$]*\s*\.\s*(\w+)/.exec(String(valueExpr).trim());
+  const t = m ? m[1] : "";
+  if (t === "number") return { type: "number" };
+  if (t === "boolean") return { type: "boolean" };
+  if (t === "array") return { type: "array", items: { type: "object" } };
+  if (t === "object") return { type: "object" };
+  return { type: "string" };
+}
+
+// Fields of "<keySrc>: Joi.object({ ... })" (validate.payload / validate.query / response.schema)
+function joiObjectFields(text, keySrc) {
+  const re = new RegExp(
+    "\\b(?:" +
+      keySrc +
+      ")\\s*:\\s*[A-Za-z_$][\\w$]*\\s*\\.\\s*object\\s*\\(\\s*\\{",
+  );
+  const m = re.exec(text);
+  if (!m) return null;
+  const open = m.index + m[0].length - 1;
+  const close = findClosing(text, open);
+  if (close === -1) return null;
+  const entries = splitStaticEntries(text.slice(open + 1, close));
+  if (!entries) return null;
+  const fields = {};
+  entries.forEach(function (entry) {
+    const kv = KEY_RE.exec(entry);
+    if (kv) fields[kv[1] || kv[2] || kv[3]] = joiTypeSchema(kv[4]);
+  });
+  return Object.keys(fields).length ? fields : null;
+}
+
+// Names read from the payload: destructuring, direct access, optional chaining, and through a variable that holds the payload
+function extractPayloadInfo(text) {
+  const names = [];
+  const aliases = [];
+  const add = function (n) {
+    n = String(n || "").trim();
+    if (n && /^[A-Za-z_$][\w$-]*$/.test(n) && names.indexOf(n) === -1)
+      names.push(n);
+  };
+  const P = "[A-Za-z_$][\\w$]*\\s*\\.\\s*payload";
+  let m;
+  const aliasRe = new RegExp(
+    "(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*(?::[^=;\\n]+)?=\\s*(?:await\\s+)?" +
+      P +
+      "\\s*(?:as\\b[^;\\n]*)?[;\\n]",
+    "g",
+  );
+  while ((m = aliasRe.exec(text)) !== null) aliases.push(m[1]);
+  const src = [P]
+    .concat(
+      aliases.map(function (a) {
+        return "\\b" + escapeRe(a) + "\\b";
+      }),
+    )
+    .join("|");
+
+  const destructRe = new RegExp(
+    "(?:const|let|var)\\s*\\{([^}]+)\\}\\s*=\\s*(?:await\\s+)?(?:" +
+      src +
+      ")\\s*(?:as\\b[^;\\n]*)?[;\\n]",
+    "g",
+  );
+  while ((m = destructRe.exec(text)) !== null) {
+    m[1].split(",").forEach(function (piece) {
+      piece = piece.trim();
+      if (!piece || piece.startsWith("...")) return;
+      add(piece.split(":")[0].split("=")[0]);
+    });
+  }
+  const directRe = new RegExp(
+    "(?:" + src + ")\\s*\\??\\.\\s*([A-Za-z_$][\\w$]*)",
+    "g",
+  );
+  while ((m = directRe.exec(text)) !== null) add(m[1]);
+  const bracketRe = new RegExp(
+    "(?:" + src + ")\\s*\\??\\.?\\s*\\[\\s*['\"`]([^'\"`]+)['\"`]\\s*\\]",
+    "g",
+  );
+  while ((m = bracketRe.exec(text)) !== null) add(m[1]);
+  return { names: names, aliases: aliases };
+}
+
+function inferType(name, text) {
+  if (!/^[A-Za-z_]\w*$/.test(name)) return { type: "string" };
+  let t = "string";
+  try {
+    t = inferFieldType(name, text);
+  } catch (e) {}
+  return t === "array"
+    ? { type: "array", items: { type: "object" } }
+    : { type: t };
+}
+
+function isMultipartRoute(clean) {
+  return /\bmultipart\s*:\s*(?:true|\{)|multipart\/form-data/.test(clean);
+}
+
+// A field is a file when the code uses file-only properties on it (or on a variable / loop item taken from it)
+function looksLikeFile(field, text, payloadAliases) {
+  const src = ["payload"].concat(payloadAliases.map(escapeRe)).join("|");
+  const names = [field];
+  const aliasRe = new RegExp(
+    "(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*[^;\\n]*\\b(?:" +
+      src +
+      ")\\s*\\??\\.\\s*" +
+      escapeRe(field) +
+      "\\b",
+    "g",
+  );
+  let m;
+  while ((m = aliasRe.exec(text)) !== null) names.push(m[1]);
+  const FILE_PROP = "(?:hapi|_data|pipe|path|bytes|filename)";
+  return names.some(function (a) {
+    const e = escapeRe(a);
+    if (
+      new RegExp(
+        "\\b" + e + "\\b\\s*(?:\\?\\.|\\.)\\s*" + FILE_PROP + "\\b",
+      ).test(text)
+    )
+      return true;
+    const cb = new RegExp(
+      "\\b" +
+        e +
+        "\\s*\\.\\s*(?:map|forEach)\\s*\\(\\s*\\(?\\s*([A-Za-z_$][\\w$]*)",
+    ).exec(text);
+    return (
+      !!cb &&
+      new RegExp(
+        "\\b" + escapeRe(cb[1]) + "\\s*(?:\\?\\.|\\.)\\s*" + FILE_PROP + "\\b",
+      ).test(text)
+    );
+  });
+}
+
+function buildBodySchema(clean, scanText) {
+  const info = extractPayloadInfo(scanText);
+  // Lets the shared type guesser see "request.payload.x" / "req.payload.x" as just "payload.x" (handler parameter names vary)
+  const typeText = scanText.replace(
+    /\b[A-Za-z_$][\w$]*\s*\.\s*payload\b/g,
+    "payload",
+  );
+  const joi = joiObjectFields(clean, "payload");
+  const multipart = isMultipartRoute(clean);
+  if (info.names.length === 0 && !joi && !multipart) return null;
+  const props = {};
+  info.names.forEach(function (n) {
+    if (multipart && looksLikeFile(n, scanText, info.aliases))
+      props[n] = { type: "string", format: "binary" };
+    else if (joi && joi[n]) props[n] = joi[n];
+    else props[n] = inferType(n, typeText);
+  });
+  if (joi)
+    Object.keys(joi).forEach(function (k) {
+      if (!props[k]) props[k] = joi[k];
+    });
+  const schema = { type: "object", properties: props };
+  if (multipart) schema["x-content-type"] = "multipart/form-data";
+  return schema;
+}
+
+function buildQuerySchema(clean, scanText) {
+  const q = extractQueryFieldsFromFile(scanText);
+  const joi = joiObjectFields(clean, "query");
+  const props = Object.assign({}, q ? q.properties : {}, joi || {});
+  return Object.keys(props).length
+    ? { type: "object", properties: props }
+    : null;
+}
+
+function mergeSchemas(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  const out = {
+    type: "object",
+    properties: Object.assign({}, b.properties, a.properties),
+  };
+  if (a["x-content-type"]) out["x-content-type"] = a["x-content-type"];
+  return out;
+}
+
+// ── Reading reply shapes ─────────────────────────────────────
+
+// Best-effort type from a value written in code; anything not provable stays "unknown"
+function guessType(expr, ctx, depth) {
+  const v = String(expr || "")
+    .trim()
+    .replace(/;$/, "")
+    .replace(/^await\s+/, "");
+  if (!v || depth > 3) return { type: "unknown" };
+  if (v.indexOf("||") !== -1 && !/^[\[{(]/.test(v)) {
+    const parts = v.split("||");
+    for (let i = 0; i < parts.length; i++) {
+      const t = guessType(parts[i], ctx, depth + 1);
+      if (t.type !== "unknown") return t;
+    }
+    return { type: "unknown" };
+  }
+  if (/^["'`]/.test(v)) return { type: "string" };
+  if (/^-?\d+(\.\d+)?$/.test(v)) return { type: "number" };
+  if (/^(true|false)$/.test(v)) return { type: "boolean" };
+  if (/^\[/.test(v)) return { type: "array", items: { type: "unknown" } };
+  if (/^\{/.test(v)) return { type: "object" };
+  if (/^(?:Number|parseInt|parseFloat)\s*\(/.test(v)) return { type: "number" };
+  if (/^(?:Boolean\s*\(|!)/.test(v)) return { type: "boolean" };
+  if (/(?:===|!==)/.test(v) && v.indexOf("?") === -1)
+    return { type: "boolean" };
+  if (/\.length$/.test(v)) return { type: "number" };
+  if (/\.\s*(?:map|filter)\s*\(/.test(v))
+    return { type: "array", items: { type: "unknown" } };
+  if (/^[A-Za-z_$][\w$]*\s*\.\s*params\b/.test(v)) return { type: "string" };
+  if (/^[A-Za-z_$][\w$]*$/.test(v)) {
+    const decl = new RegExp(
+      "(?:const|let|var)\\s+" + escapeRe(v) + "\\s*(?::[^=]+)?=\\s*([^;\\n]+)",
+    ).exec(ctx);
+    if (decl) return guessType(decl[1], ctx, depth + 1);
+    if (
+      new RegExp(
+        "\\{[^}]*\\b" +
+          escapeRe(v) +
+          "\\b[^}]*\\}\\s*=\\s*[\\w$.]*\\bparams\\b",
+      ).test(ctx)
+    )
+      return { type: "string" };
+  }
+  return { type: "unknown" };
+}
+
+function literalFields(text, openIdx, ctx) {
+  const close = findClosing(text, openIdx);
+  if (close === -1) return null;
+  const entries = splitStaticEntries(text.slice(openIdx + 1, close));
+  if (!entries) return null;
+  const props = {};
+  let count = 0;
+  for (const entry of entries) {
+    if (count >= 50) break;
+    if (!entry || entry.startsWith("...") || entry[0] === "[") continue;
+    const m = KEY_RE.exec(entry);
+    if (m) {
+      props[m[1] || m[2] || m[3]] = guessType(m[4], ctx, 0);
+      count++;
+      continue;
+    }
+    if (/^[A-Za-z_$][\w$]*$/.test(entry)) {
+      props[entry] = guessType(entry, ctx, 0);
+      count++;
+    }
+  }
+  const keys = Object.keys(props);
+  if (keys.length === 0) return null;
+  if (keys.length === 1 && keys[0] === "error") return null; // looks like an error reply
+  return props;
+}
+
+// First successful reply written out in the code (error replies and 4xx/5xx statuses are skipped)
+function extractResponseSchema(text) {
+  const wrap = function (props) {
+    return { type: "object", properties: props, _source: "static" };
+  };
+  const statusAfter = function (closeIdx) {
+    const tail = text.slice(closeIdx + 1, closeIdx + 200);
+    const m =
+      /^\s*\)\s*(?:\.\s*[A-Za-z_$][\w$]*\s*\([^)]*\)\s*)*?\.\s*code\s*\(\s*(\d{3})/.exec(
+        tail,
+      );
+    return m ? parseInt(m[1], 10) : 200;
+  };
+  const literalOfVar = function (name) {
+    const m = new RegExp(
+      "(?:const|let|var)\\s+" + escapeRe(name) + "\\s*(?::[^=]+)?=\\s*\\{",
+    ).exec(text);
+    return m ? literalFields(text, m.index + m[0].length - 1, text) : null;
+  };
+  let m;
+  // h.response({ ... }).code(201)
+  const r1 = /\b[A-Za-z_$][\w$]*\s*\.\s*response\s*\(\s*\{/g;
+  while ((m = r1.exec(text)) !== null) {
+    const open = m.index + m[0].length - 1;
+    const close = findClosing(text, open);
+    if (close === -1 || statusAfter(close) >= 400) continue;
+    const props = literalFields(text, open, text);
+    if (props) return wrap(props);
+  }
+  // h.response(result) where result is a literal declared in the handler
+  const r2 =
+    /\b[A-Za-z_$][\w$]*\s*\.\s*response\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/g;
+  while ((m = r2.exec(text)) !== null) {
+    if (statusAfter(m.index + m[0].length - 2) >= 400) continue;
+    const props = literalOfVar(m[1]);
+    if (props) return wrap(props);
+  }
+  // return { ... }  /  => ({ ... })
+  const r3 = /\breturn\s*\{|=>\s*\(\s*\{/g;
+  while ((m = r3.exec(text)) !== null) {
+    const props = literalFields(text, m.index + m[0].length - 1, text);
+    if (props) return wrap(props);
+  }
+  // return [ { ... } ]
+  const r4 = /\breturn\s*\[\s*\{/g;
+  while ((m = r4.exec(text)) !== null) {
+    const props = literalFields(text, m.index + m[0].length - 1, text);
+    if (props)
+      return {
+        type: "array",
+        items: { type: "object", properties: props },
+        _source: "static",
+      };
+  }
+  // return result;
+  const r5 = /\breturn\s+([A-Za-z_$][\w$]*)\s*;/g;
+  while ((m = r5.exec(text)) !== null) {
+    const props = literalOfVar(m[1]);
+    if (props) return wrap(props);
+  }
+  return null;
+}
+
+function buildResponseSchema(clean, scanText) {
+  const lit = extractResponseSchema(scanText);
+  if (lit) return lit;
+  const joi = joiObjectFields(clean, "response\\s*:\\s*\\{\\s*schema");
+  return joi ? { type: "object", properties: joi, _source: "static" } : null;
+}
+
+// ── Main ─────────────────────────────────────────────────────
+
+/**
+ * Scans Hapi routes from the codebase statically.
+ * Handles routes in server.route({..}), arrays, route consts, exported route arrays (loaded by a loader),
+ * plugins with prefixes (including nested plugins), method arrays and "*", constant/template paths,
+ * spread options, named/imported handlers, uploads, Joi schemas and TypeScript files.
+ */
+function scanHapiRoutes(cwd) {
+  const endpoints = [];
+  const seen = new Set();
+
+  const files = collectFiles(cwd);
+  const filesByAbs = {};
+  files.forEach(function (f) {
+    filesByAbs[f.abs] = f;
+  });
+  files.forEach(function (f) {
+    f.imports = readImports(f, filesByAbs);
+  });
+  const regsByTarget = {};
+  files.forEach(function (f) {
+    f.regs = readRegistrations(f, filesByAbs);
+    f.regs.forEach(function (r) {
+      (regsByTarget[r.target] = regsByTarget[r.target] || []).push(r);
+    });
+  });
+
+  files.forEach(function (file) {
+    const routeObjs = collectRouteObjects(file);
+    if (routeObjs.length === 0) return;
+    const consts = collectConsts(file);
+    const prefixes = prefixesOf(file.abs, [], regsByTarget);
+
+    routeObjs.forEach(function (obj) {
+      const props = propsOfObjectText(obj.objText, file, 0);
+      if (!props || props.method === undefined || props.path === undefined)
+        return; // not a route object
+
+      let handlerExpr = props.handler;
+      ["options", "config"].forEach(function (k) {
+        if (handlerExpr === undefined && props[k] && props[k][0] === "{") {
+          const inner = propsOfObjectText(props[k], file, 1);
+          if (inner && inner.handler !== undefined) handlerExpr = inner.handler;
+        }
+      });
+      if (obj.requireHandler && handlerExpr === undefined) return; // exported object that is not a route
+
+      const methods = evalMethods(props.method, consts);
+      const routePath = evalPath(props.path, consts);
+      if (!methods || routePath === null) {
+        // Cannot know the method/path from code alone: skipped instead of guessed
+        return;
+      }
+
+      const clean = blankOutComments(obj.objText);
+      const handlerCode = resolveHandlerCode(file, handlerExpr, filesByAbs);
+      if (
+        handlerExpr !== undefined &&
+        !handlerCode &&
+        !/^(?:async\b|function\b|\(|[A-Za-z_$][\w$]*\s*=>)/.test(
+          handlerExpr.trim(),
+        )
+      ) {
+      }
+      const scanText = handlerCode
+        ? clean + "\n" + blankOutComments(handlerCode)
+        : clean;
+      const body = buildBodySchema(clean, scanText);
+      const query = buildQuerySchema(clean, scanText);
+      const response = buildResponseSchema(clean, scanText);
+      // A handler shared by several methods cannot be split per method, so no reply shape is guessed for it
+      const shared = methods.length > 1 || methods[0] === "*";
+
+      prefixes.forEach(function (prefix) {
+        const fullPath = joinPath(prefix, routePath).replace(
+          /\{([^}]+)\}/g,
+          ":$1",
+        );
+        methods.forEach(function (method) {
+          const key = method + ":" + fullPath;
+          if (seen.has(key)) return;
+          seen.add(key);
+
+          const takesBody =
+            method === "POST" ||
+            method === "PUT" ||
+            method === "PATCH" ||
+            method === "*";
+          const takesQuery =
+            method === "GET" || method === "DELETE" || method === "*";
+          let requestBody = takesBody ? body : null;
+          if (takesQuery) requestBody = mergeSchemas(requestBody, query);
+
+          endpoints.push({
+            method: method,
+            path: fullPath,
+            description: "",
+            requestBody: requestBody,
+            responseBody: shared ? null : response,
+            routeParamMap: buildRouteParamMap(fullPath, []),
+            detectedBy: "static-scan-hapi",
+          });
+        });
+      });
+    });
+  });
+
+  return endpoints;
+}
+
+module.exports = {
+  scanHapiRoutes,
+};